xtremerat | 6e7c0cd4c136d2fcf86b2cd6dcee7c01115e52d7366acf250b38ae3290b615b0

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a261d05e838a359419f5dbc7651b95b8.exe
Size 280KB
Sample240224-wfqecaaa33
SHA256 6e7c0cd4c136d2fcf86b2cd6dcee7c01115e52d7366acf250b38ae3290b615b0
MD5 a261d05e838a359419f5dbc7651b95b8
SHA1 e60721c1d45391d504fbd5d60c4c662f315b282c
SHA512 ced39503e7ab396e90f5f90971066a1483ddc61c18c9cdb1106a45bac946de03642a9a3f1cf9cf628114bc5a6a894b93adf4a2aad0d16487c71c4df3e15a94aa
SSDEEP 6144:RzG8nriOnW/rGgGTVI7oMtzSokDp77d8w1Ya8B0jJynO4n:x1DYrKy7VfO2w1IE4n
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

backtrack5.no-ip.info

Signatures

Detect XtremeRAT payload 7 IoCs

resource	yara_rule
behavioral1/memory/2420-47-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/2420-51-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/2420-49-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/2420-52-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/2916-56-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/2420-57-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/2916-75-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Executes dropped EXE 2 IoCs

pid	Process
2668	stub28x222.exe
2420	stub28x222.EXE

Loads dropped DLL 3 IoCs

pid	Process
2196	a261d05e838a359419f5dbc7651b95b8.exe
2196	a261d05e838a359419f5dbc7651b95b8.exe
2668	stub28x222.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000014207-27.dat	upx
behavioral1/memory/2196-29-0x0000000003460000-0x00000000034BA000-memory.dmp	upx
behavioral1/memory/2668-36-0x0000000000400000-0x000000000045A000-memory.dmp	upx
behavioral1/memory/2668-53-0x0000000000400000-0x000000000045A000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2668 set thread context of 2420	2668	stub28x222.exe	30

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\stub28x222.exe	a261d05e838a359419f5dbc7651b95b8.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\æÖÚíÇÊ ÇáÌäÓ ÇáÍÏíË.pdf	a261d05e838a359419f5dbc7651b95b8.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	a261d05e838a359419f5dbc7651b95b8.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	a261d05e838a359419f5dbc7651b95b8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2000	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2668	stub28x222.exe
2000	AcroRd32.exe
2000	AcroRd32.exe
2000	AcroRd32.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2668	2196	a261d05e838a359419f5dbc7651b95b8.exe	28
PID 2196 wrote to memory of 2668	2196	a261d05e838a359419f5dbc7651b95b8.exe	28
PID 2196 wrote to memory of 2668	2196	a261d05e838a359419f5dbc7651b95b8.exe	28
PID 2196 wrote to memory of 2668	2196	a261d05e838a359419f5dbc7651b95b8.exe	28
PID 2196 wrote to memory of 2000	2196	a261d05e838a359419f5dbc7651b95b8.exe	29
PID 2196 wrote to memory of 2000	2196	a261d05e838a359419f5dbc7651b95b8.exe	29
PID 2196 wrote to memory of 2000	2196	a261d05e838a359419f5dbc7651b95b8.exe	29
PID 2196 wrote to memory of 2000	2196	a261d05e838a359419f5dbc7651b95b8.exe	29
PID 2668 wrote to memory of 2420	2668	stub28x222.exe	30
PID 2668 wrote to memory of 2420	2668	stub28x222.exe	30
PID 2668 wrote to memory of 2420	2668	stub28x222.exe	30
PID 2668 wrote to memory of 2420	2668	stub28x222.exe	30
PID 2668 wrote to memory of 2420	2668	stub28x222.exe	30
PID 2668 wrote to memory of 2420	2668	stub28x222.exe	30
PID 2668 wrote to memory of 2420	2668	stub28x222.exe	30
PID 2668 wrote to memory of 2420	2668	stub28x222.exe	30
PID 2668 wrote to memory of 2420	2668	stub28x222.exe	30
PID 2668 wrote to memory of 2420	2668	stub28x222.exe	30
PID 2668 wrote to memory of 2420	2668	stub28x222.exe	30
PID 2668 wrote to memory of 2420	2668	stub28x222.exe	30
PID 2668 wrote to memory of 2420	2668	stub28x222.exe	30
PID 2668 wrote to memory of 2420	2668	stub28x222.exe	30
PID 2420 wrote to memory of 2916	2420	stub28x222.EXE	31
PID 2420 wrote to memory of 2916	2420	stub28x222.EXE	31
PID 2420 wrote to memory of 2916	2420	stub28x222.EXE	31
PID 2420 wrote to memory of 2916	2420	stub28x222.EXE	31
PID 2420 wrote to memory of 2916	2420	stub28x222.EXE	31
PID 2420 wrote to memory of 2956	2420	stub28x222.EXE	32
PID 2420 wrote to memory of 2956	2420	stub28x222.EXE	32
PID 2420 wrote to memory of 2956	2420	stub28x222.EXE	32
PID 2420 wrote to memory of 2956	2420	stub28x222.EXE	32
PID 2420 wrote to memory of 2956	2420	stub28x222.EXE	32

C:\Users\Admin\AppData\Local\Temp\a261d05e838a359419f5dbc7651b95b8.exe
"C:\Users\Admin\AppData\Local\Temp\a261d05e838a359419f5dbc7651b95b8.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\Company\NewProduct\stub28x222.exe
  "C:\Program Files (x86)\Company\NewProduct\stub28x222.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Program Files (x86)\Company\NewProduct\stub28x222.EXE
    "C:\Program Files (x86)\Company\NewProduct\stub28x222.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:2916
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2956
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Program Files (x86)\Company\NewProduct\æÖÚíÇÊ ÇáÌäÓ ÇáÍÏíË.pdf"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

æÖÚíÇÊ ÇáÌäÓ ÇáÍÏíË.pdf

Path C:\Program Files (x86)\Company\NewProduct\æÖÚíÇÊ ÇáÌäÓ ÇáÍÏíË.pdf
Size 38KB
SHA256 dbcd732ba9eda2ace06e5e841fce206d1f81a67e2d497fc1908547c289c13ee1
MD5 b6a5bb5fe90300f258b3e2d1ec5a7429
SHA1 b04188fc41523a4e78c39a3cfcd208b4c8a80647
SHA512 2860fcbfb4cff295a62fa9beac10f8d7981aff6af9a4aa868532b8bc7a66576f0c9627f74bcb20f478b2772e221660401c65827a8af56d7068e10106fbae379e
SSDEEP 768:GbZZwJVy8cHyVO5rAyC4Sfqle7ooTC0Cy2E06V2wGrYruwBIs+ZFKxJnA+TYqU:2Qbx8NAyCP57owLCPo2Grursw9+nU
MD5 SHA1 SHA512 SSDEEP

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 35a4977b2c73f34d657d060769b80c171814c3d972ca4cec3128e9014da69081
MD5 a0bf55ba2a7ce98a0ce6835ac4ef6a1f
SHA1 9fc889379a4f37f6a9122ca13b4a5e65c760a40a
SHA512 e1edf6c3f4c8bfc94b50e0ed9527ebe2802f0b4f90720133326fec47ef02011d8fede8ca3150d90dc496a20a4560c3cbedc04567859dee596a21bd3831107179
MD5 SHA1 SHA512

Submit Download

stub28x222.exe

Path \Program Files (x86)\Company\NewProduct\stub28x222.exe
Size 81KB
SHA256 218d1b8d4a6e51a5fcdf869538fb158795887a4e3d15eced8226d234bac410e6
MD5 99f700c92c12fda98cee10c417c7fbc9
SHA1 e37a89c471c26445f1085c37fdba086a14e142fa
SHA512 5258b9e737bd2981ac0676b93a05304f9207493be8d359375cab666b188c73e352306359df8b0840cefa234ba9fa110e6ae879fb0f0801146ed7cb481d6019e5
SSDEEP 1536:xpPIqXnrZDGb6fZtEwQYBEpRj3Tkc+AH+oQe1YmYMTWzqQb:zFZDGkZtdQhRjjkc+CT1vWb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2196-29-0x0000000003460000-0x00000000034BA000-memory.dmp

Download

memory/2196-34-0x0000000003460000-0x00000000034BA000-memory.dmp

Download

memory/2196-43-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/2420-52-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2420-47-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2420-51-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2420-49-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2420-57-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2668-50-0x00000000002E0000-0x000000000033A000-memory.dmp

Download

memory/2668-53-0x0000000000400000-0x000000000045A000-memory.dmp

Download

memory/2668-36-0x0000000000400000-0x000000000045A000-memory.dmp

Download

memory/2916-56-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2916-54-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2916-75-0x0000000010000000-0x000000001004A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads